The Internet (the Information Superhighway) has provided the world with a way to rapidly and easily share vast amounts of information. Unfortunately, a large percentage of the information being disseminated is without the consent of the information's owner. There are numerous websites, Usenet newsgroups, and distributed-server networks located on the Internet whose express purpose is the illicit exchange of software programs and copyrighted materials such as music, movies, books, and art.
The illegal distribution of copyrighted music is particularly rampant, with some of the more popular distributed-server networks exchanging millions of compressed music files every day. In an attempt to reduce future lost revenue and preserving the rights of the copyright owners, a forum of more than 180 companies and organizations has created a set of guidelines known as the Secure Digital Music Initiative (SDMI).
SDMI specifies many guidelines concerning securing digital audio, but there are two primary security factors: security of content files and security of software and systems located inside a digital device. The securing of the content files is relatively simple and usually involves the use of some sort of encryption algorithm and an encryption/decryption key(s). Companies such as Liquid Audio and Intertrust have developed Digital Rights Management (DRM) software to protect content files stored on external media.
Providing security for the digital device playing the secured content file is more difficult because it involves protecting software executing on an inherently insecure programmable processor. Securing the digital device is difficult because the user has physical possession of the digital device while the manufacturer and the content provider do not. The user may attempt to hack the digital device through the software by using test equipment, logic analyzers, etc. or via physical means by replacing memory chips and other components in the digital device.
Since the user has physical possession of the digital device, the manufacturer cannot physically protect the hardware anymore than making it difficult for the user to physically modify circuitry inside the digital device. An extreme form of protection for the circuitry would be having circuitry that can detect tampering and would automatically self-destruct. Because the digital device costs money, the destruction of the digital device due to hacking when it was paid for with hard-earned money will deter most casual hackers.
In order to fully protect the software portion of the digital device, the manufacturer must provide security for all operational aspects of the digital device. From the very first operation that the digital device performs when it is first turned on to the last operation immediately before powering off, the software must be protected. Perhaps the most opportune time to hack into the software of a digital device is during its power-on sequence, also commonly referred to as the boot-up sequence. This is because during the power-on sequence, several different programs pass around the control of the digital device. If the hacker can cause the digital device to load up a program of his own design, he will gain complete control of the digital device.
Many inventions have attempted to provide power-on security for digital devices.
Some require the use of adjunct security processors or chips. While this solution may be viable for complex and expensive devices such as computers, but for high-volume, low-profit margin digital devices such as audio players, active picture frames, and other digital appliances, the use of adjunct security processors is simply not a viable solution. U.S. Pat. Nos. 5,421,006 and 5,379,342 present secured boot models using verification of the boot block of the operating system before control is transferred to the operating system.
U.S. Pat. No. 6,185,678 (the '678 patent) presents a secure model that includes securing both the verification program and the memory storing the operating system. This patent uses cryptographic certificates that expire with time and limits the validity of steps within the power-on sequence to small slots of time. The security model presented in the '678 patent is therefore, unnecessarily complex.
U.S. Pat. No. 5,937,063 presents a system to prevent unauthorized replacement of boot-up firmware embedded in modifiable memory such as flash memory and erasable-programmable read-only memory using the encryption and decryption of commands and instructions. This patent uses a secured boot device with its own built-in cryptographic unit.
Solutions that use executing programs in a protected memory space or a security coprocessor to provide security have a significant disadvantage in their requirement of a significant addition to the overall hardware requirements of the system. The increased hardware requirement results in a system with greater die area and hence greater costs. A need has therefore arisen for a method and apparatus for providing a simple and secured power-on sequence for digital devices and their protected contents.